#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/inotify.h>

#define EVENT_BACKLOG 1024 
#define EVENT_SIZE (sizeof(struct inotify_event))
#define LOG_FILE "/home/aegiryy/attrust/log.txt"

int main(int argc, char *argv[])
{
    char buf[EVENT_SIZE * EVENT_BACKLOG];
    int intfd, intwd;
    FILE *pp;
    FILE *fplog = fopen(LOG_FILE, "w+");
    if (fork())
        exit(0);
    umask(0);
    setsid();
    chdir("/");
    close(0);
    close(1);
    close(2);
    intfd = inotify_init();
    intwd = inotify_add_watch(intfd, "/var/log/audit/audit.log", IN_MODIFY);
    while (1)
    {
        read(intfd, buf, EVENT_SIZE * EVENT_BACKLOG);
        pp = popen("ausearch -k homedir -i", "r");
        fprintf(fplog, "Event occured!\n");
        fflush(fplog);
    }
    return 0;
}
